Robo Gallery

A Contributor can save script-bearing gallery settings that are rendered without sufficient escaping when an administrator edits the gallery. This permits stored JavaScript execution in the administrator’s browser. The export does not name the setting, save action or rendering function; its PR:H vector differs from the Contributor role specified in the narrative. Affected versions: < 5.2.6. The authoritative export identifies 5.2.6 as fixed for this CVE.

An Author can save script-bearing gallery settings that are rendered without sufficient escaping on the front end, causing stored JavaScript execution when someone views the gallery. The export does not name the setting or rendering function; its PR:H vector differs from the Author role specified in the narrative. Affected versions: < 5.2.6. The authoritative export identifies 5.2.6 as fixed for this CVE.

An Author can put script-bearing input in an image’s alternative-text setting. The gallery layout renders that value without sufficient escaping, allowing stored JavaScript execution in a viewer’s browser. The export does not identify the underlying field key or rendering function; its PR:H vector differs from the Author role specified in the narrative. Affected versions: < 5.2.6. The authoritative export identifies 5.2.6 as fixed for this CVE.

An Author can save script-bearing image settings that are rendered without sufficient escaping in a gallery. JavaScript can execute when someone views it, including on multisite installations where the Author lacks unfiltered_html. The exact image field and rendering function are not disclosed; the PR:H vector differs from the Author role in the narrative. Affected versions: < 5.2.6. The authoritative export identifies 5.2.6 as fixed for this CVE.

The supplied vector requires an authenticated attacker with low privileges; the exact WordPress role is not identified. Attacker-controlled content is stored and later rendered without sufficient neutralization, allowing script execution under the site origin when a victim views the affected output. The export does not identify the write endpoint, field, rendering function or victim role; an administrator session is exposed only if that user encounters the content. The vector reports low confidentiality impact, low integrity impact, low availability impact. Affected versions: <= 5.1.6. The authoritative export identifies 5.2.6 as fixed for this CVE.

Robo Gallery – Photo & Image Slider is affected by cross-site scripting. Exploitation requires an authenticated author account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 5.1.3.

Robo Gallery is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Photo Gallery, Images, Slider in Rbs Image Gallery is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Photo Gallery, Images, Slider in Rbs Image Gallery is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Robo Gallery is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Photo Gallery, Images, Slider in Rbs Image Gallery is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Robo Gallery is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Robo Gallery is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Photo Gallery, Images, Slider in Rbs Image Gallery is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation.

Photo Gallery, Images, Slider in Rbs Image Gallery is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Photo Gallery, Images, Slider in Rbs Image Gallery is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

Robo Gallery is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Photo Gallery, Images, Slider in Rbs Image Gallery is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Photo Gallery, Images, Slider in Rbs Image Gallery is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Robo Gallery is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

Robo Gallery is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Robo Gallery is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.